{
  "finding_id": "DF-4237",
  "title": "sili(4) sili_cam_probe/NCQ-renegotiation dereference sili_ata_get_xfer() result without NULL check - kernel panic when reprobe runs against a saturated ccb pool",
  "verdict": "not_reproduced",
  "impact": "none",
  "confidence": "likely",
  "fix_status": "not_testable",
  "reproduce": {
    "build": "cc -O2 -Wall -o sili_model sili_ncq_pool_model.c",
    "run": "./sili_model ; ./sili_model guard",
    "expected": "shipped mode: Scenario A prints 'PANIC: sili_cam.c:372 xa->tag read through NULL xa after loop held 1 slots (iteration 2/31)' and exits 3; guard mode defers both scenarios, exit 0. Live kernel trigger requires a SiI 3124/3132 HBA (absent on the audit guest)."
  },
  "kernel_refs": [
    "sys/dev/disk/sili/sili_cam.c:289-294",
    "sys/dev/disk/sili/sili_cam.c:365-381",
    "sys/dev/disk/sili/sili_cam.c:944-945",
    "sys/dev/disk/sili/sili_cam.c:1026",
    "sys/dev/disk/sili/sili_cam.c:1420",
    "sys/dev/disk/sili/sili.c:2003-2018",
    "sys/dev/disk/sili/sili.c:2318-2327",
    "sys/dev/disk/sili/sili.c:265-268",
    "sys/dev/disk/sili/sili.c:511-512",
    "sys/dev/disk/sili/sili.c:845-849"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "sili_ncq_pool_model.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}